IT support for law firms in Hong Kong has one job above all others: keep client confidences confidential while fee earners meet every filing date and completion. Our managed IT service can run the document management system, Microsoft 365, laptops, backups and email security for a solicitors' firm in Hong Kong or Singapore, and keep the evidence clients, insurers and the Law Society may ask to see. Managed IT starts from HK$195 per user per month in Hong Kong and S$100 in Singapore, on an annual commitment.
P1 and P2 incidents: on-site within 4 business hours, or at a planned time. Project-level SLAs can be agreed separately. Full SLA and priority definitions →
We look after the servers, sync clients, Outlook add-ins and permissions around your document management system and your practice or accounts system, and liaise with the software vendor when the fault is theirs.
Multi-factor sign-in, conditional access, mailbox rule alerts, external-sharing limits and DMARC for the firm's domain, starting from a scored audit.
Every device that opens matter files is enrolled, encrypted and patched, and can be locked or wiped remotely if it goes missing.
Mailboxes, document libraries and document management data backed up outside the tenant, with a restore test you watch us run.
Short sessions and simulated phishing built around changed bank details, fake counterparties and urgent client requests.
A virtual CIO for the risk register, client panel questionnaires and cyber insurance forms; the Premium plan adds a vCIO annual roadmap.
A solicitor's duty to keep client affairs confidential does not pause because a file sits in the cloud. In practice the leaks are ordinary: a matter folder shared with 'anyone with the link', a trainee who still has access after moving to another team, an inbox rule forwarding a partner's mail to a personal account, a printer that keeps scanned copies. None of these looks like a breach until a client or the Law Society asks how it happened. The IT setup has to make the confidential path the easy one, and it has to leave a record showing who could see what, and when.
What we doWe map who should see which matters, then set permissions in the document management system and Microsoft 365 to follow that map, including ethical walls where one team must not see another team's matter. External sharing can be limited to named guests with expiry dates and anonymous 'Anyone' links switched off; both settings are on the list the Microsoft 365 security audit checks. Joiners and leavers are handled through Microsoft 365 user management on every plan, and where account management reporting is in your scope, the evidence is recorded account by account. How detailed the matter access map should be is agreed in the quote.
What you receiveConveyancing completions, settlement payments and client account transfers are arranged by email, which is exactly why fraudsters target law firms. The usual pattern is a compromised mailbox at the firm, the client or the other side's solicitors, followed by a polite message with 'updated' bank details sent just before money moves. Business email compromise rarely needs malware: a stolen password, no multi-factor sign-in and a hidden forwarding rule are enough. Accounts staff and conveyancing clerks are the people who stop it, so the controls and the training have to be built around their day.
What we doThe Business plan adds an MFA policy and conditional access for every account, and the Microsoft 365 security audit checks legacy sign-in, external auto-forwarding and inbox rules, and SPF, DKIM and DMARC on every domain, including parked ones. DMARC and email security are part of Premium, or can be added on their own, so others cannot easily send mail as your firm. The call-back rule is the firm's own procedure: any change of bank details is confirmed by phone to a number already on file. Security awareness training and simulated phishing rehearse exactly those payment-change requests. The audit gives the starting score before anything changes.
What you receiveLimitation dates, court filing deadlines and completion days are fixed. If the document management system will not open a precedent at 5.30 pm, or a bundle cannot be uploaded through the Judiciary's e-filing system because a certificate has expired, the firm cannot ask the court for patience because of IT. Downtime in a law firm is not a lost afternoon; it can be a missed deadline with a professional negligence claim behind it. Support has to know which matters are close to a deadline and what has to work first.
What we doFiling days depend on a short list of things: the document management system, PDF and bundling tools, digital certificates, scanners and the court portals you use. A register of these systems, showing which deadlines depend on which of them, can be agreed in the quote, and certificates themselves are priced on our digital certificates page. Response targets follow your plan: Essentials 1-hour response and 4-hour remote resolution on working days; Business 30-minute response and 2-hour remote resolution with one on-site visit a month; Premium 7x24, 15-minute response and 1-hour remote resolution. Full terms are on the SLA page.
What you receivePrecedents, matter files, correspondence and time entries live in the document management system and the practice or accounts system. These platforms sit between Microsoft Office, Outlook, the file server or cloud tenant and the vendor's own support desk. When saving to a matter fails or a profile search returns nothing, the vendor blames Windows and the generalist IT company blames the vendor. A firm needs someone who understands both sides, owns the ticket until the fault is found and keeps a record of how the system is configured.
What we doOur service scope includes vendor liaison for third-party issues, which is what a document management system fault usually needs. During onboarding we record how your document management system, practice or accounts system and their Office add-ins are installed and connected, in the technical runbook and configuration database we build for every client. If the cause sits with the vendor, we raise it, give them the logs and follow it up, instead of passing the fee earner back and forth. Change management is part of the same scope, and upgrade windows can be agreed with the firm around court days.
What you receiveBanks, insurers and listed companies put their law firms through panel reviews with security questionnaires attached. Professional indemnity and cyber insurance renewals ask whether multi-factor sign-in, encrypted laptops, offline backups and staff training are in place. A common pattern is that small and mid-sized firms answer from memory, and an answer that turns out to be wrong after an incident can affect cover. The firm needs answers drawn from what is actually configured, plus a written plan for whatever is not there yet.
What we doOur virtual CIO answers client panel questionnaires and insurance proposal forms from what is really configured, never from what we wish were in place. Where there is a gap, we write it down with a plan to close it, and the risk register keeps it in front of the partners. A separate, access-controlled location for client due diligence records, with an audit trail of who opened each one, can be set up as part of the scope agreed in the quote. On the Premium plan, the partners also receive a vCIO annual roadmap and compliance mapping.
What you receiveSolicitors are covered by the customer due diligence and record-keeping requirements in Hong Kong's Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615), with Law Society practice directions on top, and Singapore firms have equivalent rules under the Legal Profession Act. Identity documents, ownership charts and screening results have to be kept, retrieved quickly and protected, because they are themselves sensitive personal data. When a record sits in one lawyer's mailbox or a desktop folder, the firm cannot show it on request or prove who opened it.
What we doOur virtual CIO answers client panel questionnaires and insurance proposal forms from what is really configured, never from what we wish were in place. Where there is a gap, we write it down with a plan to close it, and the risk register keeps it in front of the partners. A separate, access-controlled location for client due diligence records, with an audit trail of who opened each one, can be set up as part of the scope agreed in the quote. On the Premium plan, the partners also receive a vCIO annual roadmap and compliance mapping.
What you receiveTick what is true today. The result stays in your browser.
Tick at least one item.
Per user, per month, annual commitment. Figures read from the live price list.
HK$295 per user × 20 · List prices valid to 2026-12-31
Essentials HK$195 · Business HK$295 · Premium HK$430
Wording is taken from the home-page plan table. Project-level SLAs can be agreed separately. SLA · Price assumptions
Solicitors' firms in Hong Kong and Singapore, from a two-partner conveyancing practice to a regional disputes team, tend to run on the same handful of systems. There is Microsoft 365 for mail, calendars and Teams. There is a document management system, either a dedicated legal platform or a structured SharePoint library, holding precedents and matter files. There is a practice or accounts system for time recording, billing and the client account. Around these sit PDF and bundling tools, dictation software, scanners and multifunction printers, and access to court and land registry portals.
The people using them are not uniform. Partners work from court, client offices and home, often on a phone. Trainees and paralegals handle bulk documents and discovery. Secretaries manage diaries and filing. Accounts staff move client money. Each group needs different access, and a common weakness is that everyone has been given the same broad permissions because that was quickest when the firm was small.
Data is also unusually long-lived. Matter files, know-your-client records and correspondence are kept for years after a matter closes, often across several storage generations: an old file server, a scanned archive, a cloud library. Part of IT support for a law firm is knowing where each generation lives, who can reach it and whether it can still be restored. When any provider takes over a firm's IT, mapping these systems and the people around them should be the first piece of work, and the result belongs in a technical runbook that the next provider or auditor would also need.
Generic IT providers can keep laptops running. The questions that separate a provider suitable for a law firm are about confidentiality, deadlines and evidence. Ask each candidate to explain, in writing, how they would handle a matter that needs an ethical wall, what they would do if a partner's mailbox showed a new forwarding rule at 11 pm, and who owns a fault in the document management system when the vendor says it is a Windows problem.
Ask how their engineers' own access to your systems is controlled. A provider holds administrator rights over every client file you have, so they should use named accounts with multi-factor sign-in, log their actions and remove access when an engineer leaves. Ask whether they will sign a confidentiality undertaking that reflects your professional obligations, and whether their contract lets you take your configuration records and passwords with you if you leave.
Ask for the response and resolution commitments in the contract, not in a brochure, and check what happens outside office hours if your litigators work late before a hearing. Ask how they test backups, and when they last did a restore for a firm like yours. Finally, ask how they would help with the next client security questionnaire. If the answer is that they will fill it in for you, ask how they will evidence each answer.
The MSP selection scorecard turns questions like these into a scoring sheet that any firm can use to compare providers, including us. For firms with offices in both Hong Kong and Singapore, also ask whether one team will run both offices to the same standard, or whether you are buying two separate services that happen to share a logo.
Managed IT for a law firm is priced per user per month. Our plans start from HK$195 per user per month in Hong Kong and S$100 in Singapore on an annual commitment, and the calculator on the home page shows the figure for your headcount and plan. Four things move the total for a law firm more than for most businesses.
The first is the plan. Essentials covers working-day support; Business adds faster response and a monthly on-site visit; Premium adds round-the-clock cover, which suits litigation teams that prepare bundles late at night. The second is the security add-ons the firm chooses: a Microsoft 365 security audit, device management, backup outside the tenant, phishing simulation, DMARC and vulnerability scanning are priced separately so you only pay for what you need. The third is on-site work beyond the plan, which is bought with prepaid tokens explained on their own page. The fourth is project work, such as moving an old file server into a new document management system, quoted as a separate project.
What usually does not change the price is the practice area. A conveyancing practice and a disputes boutique of the same size buy the same plan; they simply weight the add-ons differently. A conveyancing practice might reasonably start with email security and payment-fraud training, a disputes practice with backup and deadline support. The assumptions behind our prices, including what counts as a user, are written out on the price assumptions page, so you can compare like with like before talking to anyone.
The technology in a Hong Kong firm and a Singapore firm is nearly identical. The rules around it differ. In Hong Kong, personal data is governed by the Personal Data (Privacy) Ordinance (Cap. 486), solicitors' conduct by the Legal Practitioners Ordinance (Cap. 159) and the Hong Kong Solicitors' Guide to Professional Conduct, and anti-money laundering duties by Cap. 615. In Singapore, it is the Personal Data Protection Act 2012, including its mandatory data breach notification, and the Legal Profession (Professional Conduct) Rules 2015. Court systems differ too: Hong Kong's Judiciary is rolling out e-filing through its integrated court case management system, while Singapore firms file through eLitigation. We apply one technical standard across both offices and adjust the record-keeping and incident steps to each jurisdiction, with your own counsel deciding what the law requires.
Onboarding follows the same published programme for every client. It starts with a survey and IT audit: we list the systems, the devices and who can open which matters, and agree the scope of work. Knowledge transfer follows, with a technical runbook and configuration database built for your systems, then a shadow period in which our engineers practise your support processes before go-live. For smaller environments this is typically completed within two to four weeks, and a formal review 30 days after go-live catches any knowledge gaps. Every plan includes free onboarding hours. For law firms we recommend turning on multi-factor sign-in, checking mailbox forwarding rules and backing up outside the tenant first, because those close the routes that cost firms money fastest.
Change windows can be agreed around your diary of trial dates and completions, so that nothing is switched over the night before a big hearing.
We list every system and device, record who can open which matters today, and agree the scope of work with the office manager and practice group leads.
Your document management system, practice system and Microsoft 365 setup go into a technical runbook and configuration database.
Engineers practise your support processes before go-live; multi-factor sign-in and backup outside the tenant are the first changes we recommend, timed around court dates.
A formal review 30 days after go-live identifies knowledge gaps and updates the runbook.
We have no signed contract in this sector that we can publish yet. The signed contracts below are from adjacent sectors; they show the same delivery methods (resident engineers, multi-site on-site visits, network installation). They are not case studies from this sector.
This is an advisory firm, not a law firm. It shows the arrangement many small Hong Kong practices need: a part-time engineer who covers desk-side support whenever the in-house IT person is away, delivered through the firm's existing IT provider.
An executive search firm, not a law firm. Like a regional law practice, it runs offices in several jurisdictions; the engagement started with a one-off visit and moved to resident support across Hong Kong, Malaysia and mainland China.
A research and advisory firm, not a law firm. It shows on-demand on-site visits to a Hong Kong office combined with storage of spare IT equipment, the same pairing a law firm uses to keep replacement laptops ready for fee earners.
We implement the controls and keep the evidence; legal interpretation stays with your own adviser.
Data Protection Principle 4 requires all practicable steps to protect personal data against unauthorised access, and the firm must use contractual or other means where a data processor such as an IT provider handles that data. Client files, HR records and know-your-client documents are all in scope. We implement access control, encryption and logging and keep the evidence; legal interpretation belongs to your own counsel.
Official text ↗The Protection Obligation (section 24) requires reasonable security arrangements, and the Data Breach Notification Obligation (sections 26A to 26E) requires the firm to assess a breach and, where it is notifiable, tell the Personal Data Protection Commission and affected individuals. We run the controls and help assemble the incident timeline; legal interpretation belongs to your own counsel.
Official text ↗Hong Kong solicitors are bound by the Legal Practitioners Ordinance (Cap. 159) and the Hong Kong Solicitors' Guide to Professional Conduct; Singapore solicitors by the Legal Profession (Professional Conduct) Rules 2015. Both require client affairs to be kept confidential. Matter-based access, controlled sharing and audit logs are how that duty is met in IT terms. We implement the controls and keep the evidence; what the rules require of your firm is for your counsel and your Law Society.
Official text ↗The Anti-Money Laundering and Counter-Terrorist Financing Ordinance applies customer due diligence and record-keeping requirements to solicitors for specified transactions, with Law Society guidance on top. Singapore has equivalent rules for law practices. An access-controlled, logged and backed-up location for due diligence records can be agreed in the quote; we implement the controls and keep the evidence, and legal interpretation belongs to your own counsel.
Official text ↗The Hong Kong Judiciary publishes technical requirements for e-filing and remote hearings, and the Law Society reminds members to rely on their own technical advice. We support the devices and browsers your lawyers file from, and checks against the published requirements before a filing deadline can be agreed or booked as token hours; legal interpretation belongs to your own counsel.
Official text ↗No question matches. Try another word.
Updated · Reviewed every quarter; regulation links checked monthly.
3 contracts Clinics, medical groups, pharmaceutical and device companies: patient data, clinical systems, regional offices.
1 contract Hotels and restaurant groups: 24-hour operations, guest Wi-Fi, payments and point of sale.
5 contracts Funds, family offices, banks and insurers: uptime, regulator expectations and cyber risk.
3 contracts Accounting, consulting and design firms: client data, busy seasons, small IT teams.
Pick a market, a headcount and a plan; the calculator shows the price and what is included.
